Document and verify Pentect's own trust and network boundaries

## Source

Several intermediate-presentation participants said that Pentect can read sensitive local data and asked why they should trust it more than the coding agent or model provider.

## Problem

Being open source is useful but does not by itself show what data Pentect reads, stores, or sends. Users need a concrete, testable description of Pentect's privileges and outbound network behavior.

## Acceptance criteria

- Publish a concise threat model covering the local user account, same-user processes, child processes, plugins, model providers, remote tools, and logs.
- List every intended outbound destination class and why it is contacted.
- Explain which components can read project files, environment files, the memory store, and restored plaintext.
- Document local persistence, file permissions, retention, rotation, and deletion.
- Provide a reproducible network-capture test showing that synthetic secrets are not sent outside the configured model destination.
- Document plugin isolation and the limits of that isolation.
- Clearly state what Pentect does not protect against.
- Keep claims tied to automated evidence or reproducible manual verification.

Start by mapping the proxy's model-provider, child-process, plugin, logging, memory-store, persistence, and network paths. Identify the existing automated checks or reproducible manual steps that can support each claim, then define the threat model, destination classes, access boundaries, retention behavior, and plugin-isolation limits. Done means the documentation is published and the network-capture test demonstrates that synthetic secrets stay within the configured model destination.

Written by the indexing model from the issue text.